npm audit Won't Save You in the First Hour of a Supply-Chain Alert

When the ua-parser-js maintainer's npm token was stolen in October 2021, the poisoned release sat...